CTI common mistakes
CTI · Understand the traps and how to avoid them.
Treating threat intelligence as synonymous with indicator feeds, so any question asking 'what is threat intelligence' gets answered with 'a list of IOCs' or 'malware signatures' rather than a definition centered on decision support, context, and the intelligence cycle.
Candidates arrive from SOC or tooling backgrounds where 'threat intel' means the IP and hash feed plugged into a SIEM, so they map the exam's definitional questions onto their operational experience instead of the discipline's framing.
What to do instead
Before answering definitional items, anchor on the formula 'evidence-based knowledge about an existing or emerging menace or hazard, including context, mechanisms, indicators, implications and actionable advice, that informs decisions.' Test each answer choice against whether it produces a decision or just a data point; a bare indicator list fails that test.
Confusing strategic, operational, and tactical intelligence levels, for example labeling a report on adversary campaign intent and targeting as 'tactical' because it mentions malware, or calling a hash list 'strategic' because it is shared at the executive level.
The levels are usually taught as a ladder, but exam items scramble them by describing the audience, the time horizon, and the content separately; candidates latch onto a single keyword (malware, C-suite, TTP) instead of weighing all three dimensions.
What to do instead
Classify by consumer and time horizon first: strategic serves executives and policy over months to years (intent, capability, risk); operational serves defenders planning campaigns over weeks (how an adversary operates, which targets); tactical serves immediate detection and response (TTPs, indicators). Then check the content matches the consumer. If the stem gives an audience, that is usually the deciding signal.
Answering framework questions by pattern-matching names to definitions without distinguishing what each framework actually models: mixing up the Cyber Kill Chain's linear stages with ATT&CK's adversary-behavior matrix, or claiming ATT&CK prescribes defensive controls rather than describing behavior.
All these frameworks appear together in vendor decks, so candidates memorize labels but not scope. Items that probe limitations or correct use (for example, which framework is best for mapping detection coverage versus which describes campaign phases) expose the gap.
What to do instead
Build a one-line functional profile for each: Kill Chain = seven-phase intrusion progression, good for disruption points; ATT&CK = knowledge base of adversary tactics and techniques observed in the wild, used for detection mapping and gap analysis, not a control catalog; Diamond Model = event-centric model linking adversary, capability, infrastructure, victim; STIX/TAXII = representation and transport standards, not analytic methods. Answer by asking what the question needs: describing behavior, describing an event, or moving data.
Skipping or reordering lifecycle phases under time pressure, especially omitting requirements/direction and dissemination, and treating collection as the first step because it feels like where the work starts.
Practitioners often inherit a pipeline that already has requirements defined and consumers identified, so the front and back of the cycle are invisible in daily work. Exam items that describe a program failing because it collects without requirements target exactly this blind spot.
What to do instead
Memorize the cycle as direction, collection, processing, analysis and production, dissemination, and feedback, and remember it is iterative, not linear. For scenario items, diagnose by locating the missing phase: unfocused collection means missing direction; reports nobody reads means missing dissemination or feedback; raw feeds with no normalization means missing processing.
Treating collection as 'get more feeds' and failing to apply source evaluation criteria, so items asking how to prioritize or validate sources get answered with volume-based reasoning (more sources, more coverage) instead of relevance, reliability, timeliness, and cost.
Feed proliferation is common in real programs and vendor marketing reinforces it, so candidates default to breadth. The exam instead tests source vetting, collection plans tied to priority intelligence requirements, and the tradeoff between open, commercial, and closed sources.
What to do instead
Tie every collection decision back to a requirement: a source earns its place only if it answers a PIR and meets reliability, timeliness, and cost thresholds. Learn to distinguish primary versus secondary sources and to apply structured source-reliability and information-credibility grading. When an item offers 'add more feeds' against 'define requirements and evaluate sources against them,' the latter is almost always correct.
Confusing data, information, and intelligence in processing and analysis items, and treating enrichment, normalization, deduplication, and scoring as optional housekeeping rather than as steps that determine analytic quality.
Processing is unglamorous and often automated, so candidates underweight it. Items that describe conflicting indicator formats, duplicate alerts, or unverified indicators being actioned are testing whether the candidate recognizes processing failures as the root cause.
What to do instead
Use the ladder data (raw) to information (structured, contextualized) to intelligence (analyzed, with implications and confidence). In scenarios, ask whether the described problem is a representation/transport issue (processing), a reasoning issue (analysis), or a delivery issue (dissemination), and answer at that layer rather than jumping to 'buy a better tool.'
Expressing analytic conclusions with false certainty or without stating confidence and assumptions, and answering 'analysis' items with the strongest-sounding judgment rather than the one that reflects evidence quality and analytic standards.
Candidates equate confident writing with good analysis, and operational culture rewards decisive statements. Items grounded in structured analytic techniques and analytic standards reward calibrated language, alternative hypotheses, and explicit confidence.
What to do instead
Practice writing judgments with likelihood and confidence language and separating what is known from what is inferred. When an item presents two conclusions, prefer the one that acknowledges uncertainty, states assumptions, and considers alternative explanations. Learn the purpose of key assumptions checks, analysis of competing hypotheses, and devil's advocacy as counters to anchoring and confirmation bias.
Framing dissemination as broadcasting finished reports, so items about making intelligence actionable get answered with 'send the report to all stakeholders' rather than tailoring format and content to the consumer and integrating into workflows such as SIEM, SOAR, or ticketing.
Candidates think dissemination ends the job, while the exam tests whether intelligence changes decisions. Items that describe a well-written report that no team acts on are probing integration and feedback, not writing quality.
What to do instead
Match product to consumer: executives get strategic assessments with risk and recommendations; hunters get TTP-level detail mapped to ATT&CK; detection engineers get machine-readable indicators and detection logic. Remember feedback loops: dissemination includes measuring whether the consumer acted and feeding that back into requirements. Prefer answers that integrate into existing tooling over answers that add another distribution channel.
Treating threat hunting as alert triage or as indicator sweeping, and answering hunting items with 'run the IOC feed against EDR' instead of hypothesis-driven, TTP-based search across the environment.
Many candidates' first exposure to 'hunting' is threat-intel-driven IOC searches, which look like hunting but are detection, not hypothesis generation. Exam items distinguish proactive hypothesis testing from reactive alert handling.
What to do instead
Define hunting as a proactive, hypothesis-driven process assuming the adversary is already present, informed by TTPs and situational awareness, with outputs that become new detections. If an answer begins with a specific alert or a feed match, it is triage; if it begins with a hypothesis derived from adversary behavior and ends with detection improvement, it is hunting.
Ignoring operational security and program-management constraints, such as discussing indicators on open channels, sharing sensitive reporting without handling rules, or recommending tool purchases without tying them to requirements, metrics, or legal and privacy considerations.
OPSEC and governance are cross-cutting and rarely the focus of hands-on technical work, so candidates skip them. Scenario items that include a sharing decision, a handling caveat, or a budget question reward the candidate who notices the constraint.
What to do instead
When a stem mentions sharing, attribution, sources, or program investment, scan for the answer that respects handling markings (for example TLP), protects sources and methods, and ties spending to requirements and measurable outcomes. Remember that program value is demonstrated through metrics tied to decisions, not through volume of feeds or reports.